OpenAI Guardrails (Python)
OpenAI's open-source Python guardrails package that detects prompt injection and validates tool calls against user intent
Overview
OpenAI Guardrails (Python) is OpenAI's open-source package for adding configurable safety and compliance guardrails to LLM applications, distributed as a drop-in wrapper around the standard OpenAI Python client. Rather than requiring developers to build validation logic from scratch, it ships a library of pluggable checks—moderation, PII detection, hallucination detection, jailbreak and NSFW filtering, off-topic scoping, and URL allow/blocklisting—that run automatically against inputs and outputs. Its standout capability for agentic applications is a dedicated Prompt Injection Detection check that evaluates whether requested tool/function calls actually align with a user's stated goal before they execute, and again inspects tool outputs after execution to catch data exfiltration or scope creep smuggled back through tool results.
Configurations can be authored through a hosted UI at guardrails.openai.com or as JSON files loaded directly in code. For teams building on the OpenAI Agents SDK, the package provides a GuardrailAgent class for native multi-agent enforcement—distinct from (though complementary to) the Agents SDK's own lower-level "tool guardrails" concept, which wraps individual function tools with input/output checks rather than applying a centralized policy engine.
The Verdict
Who Should Use OpenAI Guardrails?
Best For
- Teams building tool-calling agents on the OpenAI API or Agents SDK who want first-party guardrails maintained by OpenAI
- Developers who need to catch tool calls that drift from user intent (goal hijacking) rather than just filtering raw text
- Projects that want a no-code way to configure and iterate on guardrail policies via the hosted config UI
- Teams that need to benchmark and tune guardrail thresholds against labeled datasets before shipping
Not Ideal For
- Applications built on non-OpenAI model providers—checks are designed around OpenAI models and the OpenAI client/Agents SDK
- Teams wanting a mature, battle-tested library—this is an early-stage "Preview" project (2025) with a small star count and evolving API
- Cost-sensitive deployments where every LLM-based guardrail check adds an extra billed model call
- Non-Python stacks, since the package and its Agents SDK integration are Python-only
What's Great
- Prompt Injection Detection check validates tool calls at two checkpoints—before execution (does the requested function match the user's goal?) and after execution (does the tool's response leak unrelated data?)
- Drop-in wrapper design means minimal code changes to add moderation, PII, hallucination, and jailbreak checks to an existing OpenAI client integration
- Built-in evaluation/benchmark CLI compares models via ROC curves and latency analysis against labeled JSONL datasets, so teams can tune confidence thresholds with data rather than guesswork
- Native `GuardrailAgent` integration with the OpenAI Agents SDK for enforcing policies across multi-agent workflows
- Hosted no-code configuration UI (guardrails.openai.com) lowers the barrier to defining and editing guardrail policies
- MIT licensed and maintained directly by OpenAI
Watch Out For
- Labeled "Preview" and still young (first releases in 2025)—expect breaking API changes as it matures
- LLM-based checks like Prompt Injection Detection require an extra model call per check (e.g. gpt-4.1-mini), adding latency (~1.5s median) and API cost on top of the primary request
- Detection quality is tied to the configured judge model and confidence threshold; tuning is required to balance false positives against missed injections
- Tightest fit is with OpenAI's own client and Agents SDK—less turnkey for multi-provider or non-OpenAI agent stacks
- Relatively small community (a few hundred GitHub stars) compared to more established guardrail frameworks
Pricing
View all features & details
Key Features
- Drop-in wrapper around the OpenAI Python client for automatic input/output validation
- Prompt Injection Detection: LLM-judged check that validates tool-call alignment with user intent before execution, and re-checks tool outputs after execution for leaked/unrelated data
- Additional built-in checks: Moderation, URL Filter (allow/blocklist), PII detection, Hallucination Detection (via vector stores), Jailbreak detection, NSFW text filtering, Off-Topic Prompts
- Custom LLM-based guardrails for org-specific policies
GuardrailAgentclass for native integration with the OpenAI Agents SDK in multi-agent workflows- Evaluation CLI (
guardrails.evals.guardrail_evals) with benchmark mode, ROC curve generation, and latency analysis across labeled JSONL datasets - Hosted no-code configuration UI at guardrails.openai.com
- Configurable per-check parameters (e.g. model, confidence_threshold, max_turns, include_reasoning) for tuning accuracy vs. latency
Use Cases
- Preventing indirect prompt injection where malicious content in tool/function outputs tries to redirect an agent's next action
- Validating that an agent's requested tool calls actually serve the user's stated request (e.g. blocking a "transfer funds" call triggered by a weather query)
- Catching data exfiltration where a tool response smuggles unrelated sensitive data back into the conversation
- Adding moderation, PII redaction, and jailbreak filtering to production OpenAI-based chat and agent applications
- Benchmarking and tuning guardrail models/thresholds against internal red-team or labeled attack datasets before deployment
How It Compares
| Feature | OpenAI Guardrails | Guardrails AI | NeMo Guardrails |
|---|---|---|---|
| Deployment | Self-hosted, open source (MIT) | Self-hosted, open source | Self-hosted, open source |
| Tool-Call Alignment Checkpoint | Yes—checks tool calls pre-execution and tool outputs post-execution against user intent | Not a core focus | Limited (dialogue rails, not tool-call specific) |
| Prompt Injection Detection | Dedicated LLM-judged check with tunable confidence threshold | Community validator (heuristic/model-based) | Via configurable rails and third-party detectors |
| Native Agent Framework Integration | GuardrailAgent for OpenAI Agents SDK | Framework-agnostic | Colang-based rails, works across LLM providers |
| Built-in Evaluation/Benchmark Tooling | Yes—ROC curves, latency analysis, model comparison | Limited | Limited |
| Provider Focus | OpenAI-centric | Provider-agnostic | Provider-agnostic |
| Backing | OpenAI | Guardrails AI (startup) | NVIDIA |